What is the Legal Value of NEN 7510 Certification?

Since the rejection of the National Electronic Patient Record by the Dutch Senate in 2011, data sharing within healthcare has proved to be a hot topic socially. Data exchange within healthcare can now be distinguished as a separate area of law that intersects with privacy & data protection law, healthcare law and juvenile law, among others. Despite the growing attention to the legal framework of ICT in healthcare, far from everyone is familiar with the NEN 7510, or with its legal significance.

This article explains the legal significance of the NEN 7510 for parties involved in data sharing in healthcare, but this article may also be relevant for other organisations where the question exists how to achieve a legally appropriate level of security.

1.    What is the NEN 7510?

NEN 7510 is a NEN standard; the designation 'NEN' is an abbreviation for "Netherlands Norm". The Stichting Koninklijk Nederlands Normalisatie Instituut (NEN) manages and publishes NEN standards. NEN standards are market agreements on the standardisation of quality and safety of products, services and processes. The NEN 7510 standard is a standard specifically related to information security in healthcare. The NEN 7512 is a substantive elaboration of the NEN 7510, which specifically relates to the trust basis of data exchange. The NEN 7513 covers logging of actions on personal health information.

The most famous 'general' standard concerning information security that is authoritative but not sector-specific is ISO 27001 and its further elaboration ISO 27002. ISO standards are international norms concerning standardisation, these standards are issued by the ISO. By the way, the name 'ISO' for this organisation has a special meaning and is more than an abbreviation of 'International Organisation for Standardisation', as the name is derived from the ancient Greek word 'isos' meaning 'equal'. The ISO is the international organisation for standardisation, an alliance of national organisations in 163 countries of which the Dutch NEN is also a member.

2.    What is the statutory framework in which NEN 7510 is most relevant?

Following the rejection of the proposed statutory regulation on the National Electronic Patient Record, a large majority of the democratic representatives spoke out in a motion in favour of a further statutory regulation on the collection, storage and use of medical data. According to the motion, the further legal regulation had to include norms and standards on digital file creation and access, transfer of data, right of inspection, right to a copy and on patient requests for data transfer between healthcare providers. The new law had to regulate supervision, enforcement and sanctions. Also, according to the motion, requirements relating to safety, including information security, were also to be included in the legal regulation.

The Dutch Additional Provisions on Processing Personal Data in Healthcare Act of 1 July 2017 stipulates a legal obligation for healthcare providers to obtain explicit consent from patients to use their data in an electronic data exchange system. The emphasis on explicit consent as a requirement is incidentally stricter than the regime from the EU General Data Protection Regulation (GDPR), in which there are grounds for exception and grounds for processing other than consent in addition to (explicit) consent.

When does consent not suffice as grounds for the processing of personal data?

NEN standards are generally voluntary market agreements on the standardisation of quality and security of products, services and processes. The public call for more legal rules on information security in healthcare was partly answered by including the statutory obligation to comply with NEN 7510 and its further elaborations.

3.    How do standards fill in the statutory requirements on information security?

The question of what security level "the law" requires of your company or organisation cannot be answered in advance. With some regularity, frustration comes to our ears because "the law" does not prescribe exactly what concrete (cyber) security measures of a technological or organisational nature a company or organisation should take to comply with the law.

Legal obligations

The (European) legislator does not want to sit in the chair of the business or organisational leadership, nor to create the impression that the same risks exist for all data processing activities of all organisations in all sectors. Legal provisions on information security usually contain open standards and not concrete requirements to implement a particular security measure. For example, the preamble to Article 32 GDPR reads as follows:

"Having regard to the state of the art, the costs of implementation, as well as the nature, scope, context and purposes of processing and the risks to the rights and freedoms of individuals, which vary in their likelihood and seriousness, the controller and processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk [...]".

Incidentally, this broad risk approach is not unique to the GDPR, for example, Article 7 first paragraph of the Dutch Network and Information Systems Security Act (Wbni) reads:

"The essential service provider and the digital service provider shall take appropriate and proportionate technical and organisational measures to manage the risks to the security of their network and information systems. Given the state of the art, the measures shall ensure a level of security appropriate to the risks encountered."

However, pursuant to Article 32(3) GDPR, adherence to an approved code of conduct or certification mechanism can, be used as an element to demonstrate the presence of appropriate protection measures within the meaning of the GDPR and thus compliance with the legal security requirement. An example of a code of conduct approved by the Dutch Personal Data Authority for a specific industry is the "Dutch GDPR Guidelines for Accountants, Tax Consultants and Payroll Professionals (2019)". However, serving as an 'element' by which compliance with the law can be demonstrated does not mean that this always proves security compliance, this remains dependent on the facts and circumstances of the case.

Risk analysis

The technological and organisational measures to be taken should be based on the risks identified following a risk analysis. The following elements, at least in the example of the preamble of Article 32 GDPR, are mandatory to include in a risk analysis:

• State of the art;
• Implementation costs;
• Nature of risks to the rights and freedoms of individuals;
• Extent of risks to the rights and freedoms of individuals;
• Context and processing purposes;
• Likelihood of risks to the rights and freedoms of individuals;
• Severity of risks to the rights and freedoms of individuals.

The definition of a risk analysis in NEN 7510 - 'assessment of the threats to, effects on and vulnerability of information systems and data and the likelihood of these threats occurring' - is also common within the information security profession and gives an organisation the freedom to choose its own risk analysis method as long as all elements are met.

As the level of security required increases, the Controller within the meaning of the GDPR must implement more and more severe security measures to cover the risks present and ensure the required level of security.

Measures

How can you know whether the technological and organisational measures within your organisation are appropriate? Fortunately, you don't have to be completely in the dark about measures, as there are tools to go by.

Guidelines

The predecessor of the Dutch Personal Data Authority, the Dutch Data Protection College, issued a guideline on the interpretation of the concept of personal data security, which is still authoritative and provides pointers:

"In examining and assessing the security of personal data, the regulator uses as a starting point a number of security measures that are common within the field of information security and are necessary in one form or another in many situations.

• Information security policy document [...],
• Assigning responsibilities for information security[...],
• Security awareness among employees [...],
• Physical security and equipment security [...],
• Access security[...],
• Logging and monitoring [...],
• Correct processing in application systems (validation) [...],
• Managing technical vulnerabilities [...],
• Incident management [...],
• Handling data breaches and security incidents [...],
• Continuity management [...],
• Data protection and confidentiality of personal data,
• Non-disclosure agreements [...]."

Security standards

Security standards developed in practice also provide guidance on the measures to be taken to address the risks identified. The NEN 7510 is one of those security standards on information security that can provide more guidance than statutory requirements, having been developed specifically for and by the healthcare sector.

Security standards reflect the development of knowledge about 'best practices' gained in security in practice. Such security standards thus reflect what measures are generally considered 'appropriate' within a given industry. Such standards may also name concrete technological means to be applied in security, whereas laws and regulations will usually be formulated as technology-neutral as possible.

New security standards and new versions of existing security standards are published regularly, keeping up with the latest developments in the field. On 11 July 2022, the Royal Dutch Standards Institute Foundation published the revised NEN 7512, in the latest version of this standard more attention has been paid to risk management and control measures have been elaborated further. The same applies to ISO 27001, the more general security standard for information security applicable to any industry regardless of the nature of the specific processing activities. Incidentally, NEN 7510 also largely bases itself on ISO 27001, so different security standards also influence each other.

4. What are the legal implications of not having an adequate level of security?

Choosing a particular security level as 'appropriate', is a consideration that can have major legal consequences for your company or organisation, especially should it subsequently turn out that your security measures have been inadequate. The potential negative legal consequences of inadequate measures can take the form of fines, liability claims and contractual claims depending on which authority or party takes legal action against your organisation in relation to inadequate information security measures.

The maximum amounts of fines or damages and the precise options for avoiding or at least mitigating them will vary depending on the circumstances of the security incident case and the basis on which the fine/damage claim is based.

For example, you may receive a large fine from a national regulator. For example, under the GDPR, the Dutch Personal Data Authority theoretically has the power to impose fines of up to €20 million or 4% of global annual turnover. The GDPR also contains a separate liability ground under which the data subject, the a person to whom personal data relates, can claim material and immaterial damages when a Controller or Processor breaches a legal obligation under the GDPR, such as the obligation to take appropriate technological and organisational measures, and he or she has suffered damage as a result.

You may also be sued by your counterparty under an agreement for damages incurred. In such a situation, you can hopefully successfully invoke an adequate force majeure clause from the contract. It is therefore important to include a force majeure clause in your contracts that also takes cybersecurity-related risks into account.

Moreover, you could be held liable for breach of a statutory duty of care, e.g. the duty of care of a good contractor (article 7: 401 of the Dutch Civil Code) for damage caused by a security incident. The fulfilment of the duty of care is tested against the standard of whether the contractor acted "as a reasonably competent and reasonably acting professional would have acted". This standard follows, for example, from the standard judgment HR 9 June 2000, NJ 2000/460 ECLI:NL:HR:2000:AA6159. The interpretation of this statutory duty of care thus varies by professional group.

A recent example of how this yardstick is applied in the IT industry can be seen in Hof-Arnhem Leeuwarden 29 June 2021, ECLI:NL:GHARL:2021:6380, r.o. 7.16.

"7.16
In view of the foregoing, the general standard of Section 7:401 of the Civil Code that a contractor must exercise the care of a good contractor in his activities and act as a reasonably competent and reasonably acting industry peer would have done under similar circumstances applies in this case. [...]"

In that particular case, the Leeuwarden Court of Appeal ruled that the IT supplier had not breached its duty of care. However, case law on this point varies strongly case-by-case, which makes it difficult to predict the outcome of a case in which the question of whether a statutory duty of care has been met is before the court. You may also still be held liable and damages may be claimed from you in tort.

5 Conclusion

The NEN 7510 standard is a NEN standard (market agreement on the standardisation of quality and security of products, services and processes) that specifically covers information security in healthcare.
The legal value of the NEN 7510 standard consists of the fact that it is an example of a security standard developed for and by a specific sector and gives concrete substance to an appropriate way of shaping security given the nature of the risks and severity of the potential consequences.

Indeed, statutory provisions on information security usually only impose a general obligation to maintain an 'appropriate level of security'. Assessing what level of (personal) data security should be ensured given the activities of a given entity is a balancing act that must be performed again and again depending on the nature and severity of the risks associated with your company or organisation's processing activities.

There is a legal requirement for some bodies to comply with the NEN 7510 standard and its elaborations. Even though NEN 7510 certification is not necessarily mandatory for your company or organisation, obtaining this certificate may still be useful for parties outside primary care. For instance, it is very wise to obtain a NEN 7510 certificate if your company or organisation is engaged in providing IT services to healthcare providers and/or patients or is otherwise involved in managing or maintaining the processing of health data.

If your company or organisation is a data processor, but not at all active within or around healthcare, it is better to focus on the ISO 27001 standard 'Information Security', the non-sector-specific standard on information security, on which the NEN 7510 is also based, when fulfilling your legal obligations regarding putting your information security in order.

Advice

Are you looking for advice on what would be an appropriate level of security for your company or organisation? Are you wondering how best to legally demonstrate the presence and appropriateness of your information security measures?

Approach us for legal advice today!

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!